Enable automatic dependabot updates

[timomeh]

• Enables automatic dependabot updates
• Enables auto-merge of dependabot PRs for patch and minor semver dependency updates
• Configured some dependency groups to group common dependencies together, so there's less PR noise
• Adds storybook to CI, so we know that storybook still works
• Fixes an old import path in storybook

[osamaqarem]

Looks good!

"you update dependencies"

I'm personally new to configuring dependabot - my understanding is that the current setup in the PR will still create PRs for major version upgrades but they won't be auto-merged.

If we don't want major version PRs to happen at all, it seems we could use use the updates-types key shown in this example.

[osamaqarem]

If we don't want major version PRs to happen at all, it seems we could use use the updates-types key shown in this example.

Actually this is a the correct example:
https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#specifying-dependencies-and-versions-to-ignore

[timomeh]

Yes, good observations! If we don't want major versions for some dependencies, we could also tell dependabot to ignore that dependency (or temporarily ignore it until the next minor version is released) with a PR comment. I still think auto-updates for major releases are good, but it often warrants that a developer is reading the release notes before it's getting merged.